In this case, the attacker (supposedly) booted the machines into rescue mode through OVH's control panel. None of the steps you listed would've prevented that (

In this case, the attacker (supposedly) booted the machines into rescue mode through OVH's control panel. None of the steps you listed would've prevented that (I'm not saying it won't prevent other attacks.)